From May 4, 2019, employers are required to apply the new regulations governing the processing of personal data of job candidates and existing employees. The changes cover, among other things, the scope of information collected as part of the recruitment processes and processing of biometric data and were introduced mainly in order to bring the existing regulations into compliance with the GDPR.
The Act of February 21, 2019 on the amendment of certain Acts in connection with the introduction of Regulation 2016/679 of the European Parliament and Council of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC, otherwise known as the GDPR Implementing Act, introduces changes to as many as 160 legal acts. In addition to issues related to the acquisition of personal data by an employer for the purposes of the recruitment process and thereafter, the amended provisions also apply to such areas as the use of workplace monitoring and the processing of sensitive data.
According to the amended art. 22 (1) sec. 1 of the Labour Code, the employer may request from an employment candidate, the following information:
Until now, the aforementioned provision allowed for the collection of a variety of other personal data on the candidate, including, inter alia: place of residence (correspondence address) or names of parents. Due to the fact that such data are not necessary for the purposes of the recruitment process, they were deleted from the Labour Code. This does not mean, of course, that the candidate can not now voluntarily place this information in his/her CV - however, the fact that the employer can not demand it from them should be noted. As far as concerns the data on the candidate's education, his/her professional qualifications and employment history - here the employer may request such information only if it is actually necessary to perform the work in question.
The Implementing Act also introduces significant changes related to the processing of personal data of existing employees. These mainly concern biometric data and the use of monitoring at work. Following the entry into force of art 22 (1) sec.1 of the Labour Code, the employer may process the following personal data of employees:
The type of data is therefore the same as in the case of candidates, but in addition - according to the amendment to art. 22 (1) sec. 3 of the Labour Code - the employer may request additional personal data from existing employee, such as:
The employer, being the administrator of employee personal data, is obliged to provide employees with detailed rules governing the processing of such data. In article 13 of the GDPR, there are precise indications as to what information should be included in the wording of such rules.